Is CVE-2026-48054 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48054 being exploited in the wild.

How severe is CVE-2026-48054?

High severity, with a CVSS score of 8.8, published 6 August 2026.

Which products and versions are affected?

@openzeppelin/wizard (npm) <= 0.10.8, SEMVER:introduced=0,fixed=0.10.9; OpenZeppelin Wizard <= 0.10.8.

Is there a fix for CVE-2026-48054?

Yes. @openzeppelin/wizard (npm): upgrade to 0.10.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48054 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-48054?

Check whether you run @openzeppelin/wizard (npm) or OpenZeppelin Wizard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48054: OpenZeppelin Contracts Wizard code injection in generated tests

Q: Is there a fix for CVE-2026-48054?

Yes. @openzeppelin/wizard (npm): upgrade to 0.10.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48054 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-48054?

Check whether you run @openzeppelin/wizard (npm) or OpenZeppelin Wizard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48054 · Severity: high · CVSS 8.8 · Published 2026-08-06

The OpenZeppelin Contracts Wizard is a tool that generates smart contract code and test files for developers. When developers use the tool with specially crafted input names or URIs, malicious code can be injected into the generated test files. Running these tests (via npm test or forge test) would execute the attacker's code, potentially compromising the developer's environment and allowing theft of credentials, private keys, or other sensitive data.

Vendors: npm, OpenZeppelin.

Quick answers

Is CVE-2026-48054 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48054 being exploited in the wild.
How severe is CVE-2026-48054?: High severity, with a CVSS score of 8.8, published 6 August 2026.
Which products and versions are affected?: @openzeppelin/wizard (npm) <= 0.10.8, SEMVER:introduced=0,fixed=0.10.9; OpenZeppelin Wizard <= 0.10.8.
Is there a fix for CVE-2026-48054?: Yes. @openzeppelin/wizard (npm): upgrade to 0.10.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48054 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-48054?: Check whether you run @openzeppelin/wizard (npm) or OpenZeppelin Wizard at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@openzeppelin/wizard (npm): upgrade to 0.10.9 or later
```
npm install @openzeppelin/wizard@0.10.9
```

Technical details

This is a code injection vulnerability (CWE-94) in the @openzeppelin/wizard package. The zipHardhat and zipFoundry functions generate test files by directly interpolating unsanitized user input (opts.name and opts.uri) into TypeScript (test/test.ts) and Solidity (test/*.t.sol) source code respectively. An attacker can craft input containing escape sequences and arbitrary code that breaks out of the surrounding string literal and is parsed as valid code. The attack requires user interaction—a developer must download the generated project and execute npm test or forge test—but no authentication or special privileges are needed. Successful exploitation results in arbitrary code execution in the developer's local environment with the privileges of the user running the test command. The vulnerability is fixed in @openzeppelin/wizard@0.10.9 by properly escaping the user-supplied input before code generation.

Affected products

OpenZeppelin @openzeppelin/wizard <= 0.10.8

Identifiers

CVE-2026-48054
GHSA-4x76-22x2-rx8v

Timeline

2026-05-20: disclosed: Advisory published by OpenZeppelin
2026-05-20: patched: Fixed in @openzeppelin/wizard@0.10.9

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.